New Cortex XDR Integration with Claude Cowork Secures Desktop AI Agents
Palo Alto Networks, Monday, November 2nd, 2026
Palo Alto Networks announced a Cortex XDR integration that runs a lightweight sensor inside Claude Cowork's local VM.
Palo Alto Networks announced a Cortex XDR integration with Claude Cowork, the desktop agent capability in Claude Enterprise.
Cowork carries out multi-step tasks inside a small local virtual machine that acts as a security boundary, but that isolation also keeps EDR agents from seeing its activity.
The integration places a lightweight XDR sensor inside the VM to track accessed systems, file changes and executed commands and to detect and block malicious behavior in real time, using Unit 42 threat intelligence and machine learning.
VM telemetry feeds into XDR analytics, which correlates events into incidents and ties agent activity back to the desktop in the Cortex platform.